Hacker News Reader

I think it's more due to the volume of ancient systems out there that do not & will not support added security measures.

Visa 3d secure is popular now though.

View on HN

Verified By Visa is (almost?) always embedded into a merchant's page (on their domain) as an iframe. At least in Canada.

It's nearly impossible for normal users to verify that they're sending their password to their bank, and not to the merchant.

Training users to send merchants sensitive bank passwords is a step backwards.

True, it shows a prompt specified by the user at registration ... presumably that might be to establish trust? (it's been a long time since i registered mine & can't remember off hand) ... if so that's probably security theatre

I think the reset process requires postcode & DOB (in the UK anyway) which would high a good probability of being available in the data-dump type scenario.

The crazy thing is that both visa 3d secure and the same thing from mastercard dont require 2FA either at my bank. All they need is a password.

in comparison, all online banking transactions go through a challenge-response process with an separated card reader and my debit card.

Reply on news.ycombinator.com